800658dc58f5b399559085f2fd9266f82875410b988f037e44aa82f0682b4ba1 | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 06:04

Sharing

Report Analysis Logs

General

Target

hideIcon-file/hideIcon.exe
Size

35KB
MD5

365279bef6b20d95054ec5042ecfab16
SHA1

1e614a72a31dfdb40b35dbe5bdcfac05a3c8528f
SHA256

9f0526fc3562c3c631597d0feec72657b0befa5f9ddc9dc2d0db016c8e037a83
SHA512

9e5eb8ac0115f1b5caf5cf96f7f88f8ca6c4cf0a35700af9b5647bac72d7599da281eaa440249f35c7c8827bd2efdad50b33081ad99dbdc0e364fd3788a130ee
SSDEEP

768:KBIaVfYowGOXZiBRXXMifZGwBdk6nKpE0/pDxQPjulUjZqd1:KBIa7kAHXXXZvBdk6YtDwKlUA

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1256-0-0x00007FF610D30000-0x00007FF610D70000-memory.dmp	upx
behavioral2/memory/1256-1-0x00007FF610D30000-0x00007FF610D70000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 644	1256	hideIcon.exe	87
PID 1256 wrote to memory of 644	1256	hideIcon.exe	87

C:\Users\Admin\AppData\Local\Temp\hideIcon-file\hideIcon.exe
"C:\Users\Admin\AppData\Local\Temp\hideIcon-file\hideIcon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title HideIcon
  2⤵
  PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-0-0x00007FF610D30000-0x00007FF610D70000-memory.dmp

Filesize
256KB

Download
memory/1256-1-0x00007FF610D30000-0x00007FF610D70000-memory.dmp

Filesize
256KB

Download